URLhaus Database

You are currently viewing the URLhaus database entry for http://refinanz.org/bachelorme_de/6i/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

You are viewing an historical record

While the URL referenced below has been used by bad actors to spread malware in the past, the malicious content has obviously been removed around 2022-12-20. Hence the the URL / website should no longer represent a threat. As a result, URLhaus considers this record as historical. This database entry has not impact on the reputation of the website / domain nor does it appear in any of our blocklists anymore.

ID:	453090
URL:	http://refinanz.org/bachelorme_de/6i/
URL Status:	Offline
Host:	refinanz.org
Date added:	2020-09-04 06:59:06 UTC
Last online:	2020-09-04 13:XX:XX UTC
Threat:	Malware download
URLhaus blocklist:	Not blocked
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Not blocked
AdGuard :	Not blocked
Cloudflare :	Blocked
dns0.eu :	Not blocked
ProtonDNS :	Not blocked
OpenBLD :	Not blocked
DNS4EU :	Blocked
Reporter:	Cryptolaemus1
Abuse complaint sent (?):	Yes (2020-09-04 07:00:10 UTC to abuse{at}strato[dot]de)
Takedown time:	6 hours, 17 minutes (down since 2020-09-04 13:17:54 UTC)
Tags:	emotet epoch1 exe heodo

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

Firstseen	Filename	File Type	Payload (SHA256)	VT	Signature
2020-09-04	ziXnzBQA.exe	exe	2cf5d85b3fac8db43c8b9ebaf319f05585714f0c2b40d4ec513774a74a9f7919	n/a	Heodo
2020-09-04	D2cp.exe	exe	4dabd056666719e1aa7ceff5bdbb8f6d03fb8249a5ef79729bdfab8ce088a48e	n/a	Heodo
2020-09-04	KeE.exe	exe	1d0395e03bcd14c688efb4e94f30d249a1076e392b76abab73cca49941c1048c	8.82%	Heodo
2020-09-04	DKOKgV5Eu1SD1x1LHRI.exe	exe	cf5c5a54697ed019b41f54899f663a8ec70984d2d32f2d62a1d4eeb42ef7a592	10.45%	Heodo
2020-09-04	opx.exe	exe	bcc601f9cedd562fa9190f45dd94ea4be746a973483dbcd75c6813fa1c34e575	n/a	Heodo
2020-09-04	1pwFwDKVnZbwOm2V4.exe	exe	98e1d2fb8da2dc25b04b09553027637deaca603efad0ad5ec9012fc27385b31b	10.94%	Heodo
2020-09-04	NVqdsFHZBNxBfiXNd.exe	exe	22c38b5c9f0e644fcfa6dcbc5eafa368517d8c2d08d249089f141121d8bb9c02	n/a	Heodo
2020-09-04	dAbb5Y7K2cEY0Y3.exe	exe	44e05d933f2495c8b163b1a29db3a35816448c1ef59c964ee28101f494f7567e	n/a	Heodo
2020-09-04	hRoJzth.exe	exe	4e8cc2addc160565a918a5d7ff32a00c608ca6953d5473cdc841118b76c05e49	n/a	Heodo
2020-09-04	4hzNbJecGnlNE2BaewvJ.exe	exe	f31cf2adbb02bedcc5752e98d57ec84195128286084393cc24ba8ab208eeed8f	n/a	Heodo
2020-09-04	mAgBvyJdeHVwl7W4tSHg.exe	exe	3e3d24e5cd7e9d572ad6bedc0898d7978ddf31e93bb25c293b8a8e14c8b85d4a	n/a	Heodo
2020-09-04	OOaY3sxXmx.exe	exe	dea5e80046c00d6d54ea4d722768fdc67e83a764c4cdb7e0b45218419a3f4179	n/a	Heodo
2020-09-04	HTYY.exe	exe	57bc0659aa4746959ffd613de9ea8b49fee2830a238589bcde6769c6d31c027b	n/a	Heodo
2020-09-04	Y4N8sKeu.exe	exe	48e449f5bd1cd0e7f25d46921941c7f4376596f46eb1aefb96c8aa327c21adc9	n/a	Heodo
2020-09-04	JcclSMYbrDuaVg.exe	exe	128ec157f227faf1754c1f45c65872f0eb4b368a76975e3dbec5d7d03e3bfba6	n/a	Heodo
2020-09-04	33E7ljo9bmrcIib1n.exe	exe	559832507fa684033880dd8301af9d30d72c37d19233ed55ed8edf168f5d918e	n/a	Heodo
2020-09-04	ffRp0wMiTiS7aD.exe	exe	c91ca42f49d567f5a44fbd81df1dc473490151dbdb8068657b7c64cb1fb7ba18	n/a	Heodo
2020-09-04	ffRp0wMiTiS7aD.exe	exe	c91ca42f49d567f5a44fbd81df1dc473490151dbdb8068657b7c64cb1fb7ba18	n/a	Heodo
2020-09-04	Ayepz.exe	exe	d237cb078ea0a3a2bed4aed356ab5a9eb0f70bccf71f51ab00a6b16f741c326a	8.70%	Heodo
2020-09-04	fwcRxa.exe	exe	fbf31fc108849073f970a2dc194425cf0ad0d9cbf9b8fa70041b2271b9f6aba6	n/a	Heodo
2020-09-04	RE69Qc20c5ABCQ.exe	exe	2dd6deba37591d3de91d5d3fc7c2fded9490e1e3b9066a5a72eb2fffba63c7d3	20.29%	Heodo
2020-09-04	2EudM0.exe	exe	68be03042ae1d4274445039c9eb4909f1ca29a49f7af990ba06233855eafcf6a	n/a	Heodo